{
  "type": "URL",
  "indicator": "https://staging.flexradio.com",
  "general": {
    "sections": [
      "general",
      "url_list",
      "http_scans",
      "screenshot"
    ],
    "indicator": "https://staging.flexradio.com",
    "type": "url",
    "type_title": "URL",
    "validation": [],
    "base_indicator": {
      "id": 3759605438,
      "indicator": "https://staging.flexradio.com",
      "type": "URL",
      "title": "",
      "description": "",
      "content": "",
      "access_type": "public",
      "access_reason": ""
    },
    "pulse_info": {
      "count": 9,
      "pulses": [
        {
          "id": "65bbca54daebb7d2084f350d",
          "name": "Phishing HSBC (identity theft) -  Hijack Execution Flow",
          "description": "Hijack Execution Flow: Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.\n\nThere are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.",
          "modified": "2024-03-02T16:00:27.416000",
          "created": "2024-02-01T16:44:04.317000",
          "tags": [
            "backdoor",
            "generic malware",
            "mydoom",
            "threat report",
            "ip summary",
            "url summary",
            "summary",
            "sample",
            "samples",
            "detection list",
            "blacklist http",
            "hsbc group",
            "phishtank http",
            "phishing hsbc",
            "traffic",
            "tor exit",
            "exit",
            "node tcp",
            "et tor",
            "known tor",
            "tor known",
            "http spammer",
            "node",
            "spammer",
            "malicious",
            "malware",
            "team",
            "download",
            "http response",
            "final url",
            "xamzexpires600",
            "serving ip",
            "address",
            "status code",
            "body length",
            "b body",
            "sha256",
            "headers",
            "algorithm",
            "v3 serial",
            "number",
            "subject public",
            "key info",
            "key algorithm",
            "key identifier",
            "subject key",
            "identifier",
            "x509v3 key",
            "first",
            "server",
            "registrar abuse",
            "iana id",
            "contact phone",
            "dnssec",
            "domain status",
            "registrar url",
            "registrar whois",
            "llc registry",
            "expiry date",
            "date",
            "dns replication",
            "basic",
            "pe32 executable",
            "ms windows",
            "intel",
            "win32 dynamic",
            "link library",
            "os2 executable",
            "clipper dos",
            "executable",
            "pe32",
            "win16 ne",
            "pe32 installer",
            "mitre"
          ],
          "references": [
            "http://www.tripphouse.com/th_ext.php",
            "www.tripphouse.com",
            "https://attack.mitre.org/techniques/T1574/"
          ],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Phishing HSBC",
              "display_name": "Phishing HSBC",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1574",
              "name": "Hijack Execution Flow",
              "display_name": "T1574 - Hijack Execution Flow"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 7,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "OctoSeek",
            "id": "243548",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-MD5": 2190,
            "FileHash-SHA1": 244,
            "FileHash-SHA256": 775,
            "URL": 2229,
            "domain": 545,
            "hostname": 723,
            "CVE": 1,
            "email": 2
          },
          "indicator_count": 6709,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 219,
          "modified_text": "778 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a67da62bb520508659a5",
          "name": "Play Ransomware",
          "description": "",
          "modified": "2023-12-06T16:51:09.511000",
          "created": "2023-12-06T16:51:09.511000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1064,
            "hostname": 1520,
            "domain": 1023,
            "URL": 4595,
            "FileHash-SHA1": 43,
            "FileHash-MD5": 41
          },
          "indicator_count": 8286,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 112,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a67567202b93ee502ff7",
          "name": "Play Ransomware",
          "description": "",
          "modified": "2023-12-06T16:51:00.527000",
          "created": "2023-12-06T16:51:00.527000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1064,
            "hostname": 1520,
            "domain": 1023,
            "URL": 4595,
            "FileHash-SHA1": 43,
            "FileHash-MD5": 41
          },
          "indicator_count": 8286,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a66d9992e6957b2d1415",
          "name": "Play Ransomware",
          "description": "",
          "modified": "2023-12-06T16:50:53.855000",
          "created": "2023-12-06T16:50:53.855000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 8,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1064,
            "hostname": 1520,
            "domain": 1023,
            "URL": 4595,
            "FileHash-SHA1": 43,
            "FileHash-MD5": 41
          },
          "indicator_count": 8286,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 110,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "6570a667be1f5233855ae115",
          "name": "Play Ransomware",
          "description": "",
          "modified": "2023-12-06T16:50:47.344000",
          "created": "2023-12-06T16:50:47.344000",
          "tags": [],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [],
          "attack_ids": [],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 9,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "api",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "StreamMiningEx",
            "id": "262917",
            "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1064,
            "hostname": 1520,
            "domain": 1023,
            "URL": 4595,
            "FileHash-SHA1": 43,
            "FileHash-MD5": 41
          },
          "indicator_count": 8286,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 109,
          "modified_text": "865 days ago ",
          "is_modified": false,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65133a5300c7fbb0ebe0aad3",
          "name": "Play Ransomware",
          "description": "Malicious. Various unknown, unauthorized clouds set up on a device.",
          "modified": "2023-10-26T19:03:33.397000",
          "created": "2023-09-26T20:08:51.070000",
          "tags": [
            "ssl certificate",
            "historical ssl",
            "referrer",
            "subdomains",
            "resolutions",
            "communicating",
            "contacted",
            "llwn",
            "threat roundup",
            "family",
            "roots",
            "lolkek",
            "tzw variants",
            "play ransomware",
            "ursnif",
            "malware"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan/Banker.AndroidOS.bzd",
              "display_name": "Trojan/Banker.AndroidOS.bzd",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            }
          ],
          "industries": [],
          "TLP": "white",
          "cloned_from": null,
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1064,
            "FileHash-MD5": 41,
            "FileHash-SHA1": 43,
            "domain": 1023,
            "hostname": 1520,
            "URL": 4595
          },
          "indicator_count": 8286,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 225,
          "modified_text": "906 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65133a5622544406ab139161",
          "name": "Play Ransomware",
          "description": "Malicious. Various unknown, unauthorized clouds set up on a device.",
          "modified": "2023-10-26T19:03:33.397000",
          "created": "2023-09-26T20:08:53.825000",
          "tags": [
            "ssl certificate",
            "historical ssl",
            "referrer",
            "subdomains",
            "resolutions",
            "communicating",
            "contacted",
            "llwn",
            "threat roundup",
            "family",
            "roots",
            "lolkek",
            "tzw variants",
            "play ransomware",
            "ursnif",
            "malware"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan/Banker.AndroidOS.bzd",
              "display_name": "Trojan/Banker.AndroidOS.bzd",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 14,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1064,
            "FileHash-MD5": 41,
            "FileHash-SHA1": 43,
            "domain": 1023,
            "hostname": 1520,
            "URL": 4595
          },
          "indicator_count": 8286,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "906 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65133a5d65c4b99d76421b48",
          "name": "Play Ransomware",
          "description": "Malicious. Various unknown, unauthorized clouds set up on a device.",
          "modified": "2023-10-26T19:03:33.397000",
          "created": "2023-09-26T20:09:01.502000",
          "tags": [
            "ssl certificate",
            "historical ssl",
            "referrer",
            "subdomains",
            "resolutions",
            "communicating",
            "contacted",
            "llwn",
            "threat roundup",
            "family",
            "roots",
            "lolkek",
            "tzw variants",
            "play ransomware",
            "ursnif",
            "malware"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan/Banker.AndroidOS.bzd",
              "display_name": "Trojan/Banker.AndroidOS.bzd",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 15,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1064,
            "FileHash-MD5": 41,
            "FileHash-SHA1": 43,
            "domain": 1023,
            "hostname": 1520,
            "URL": 4595
          },
          "indicator_count": 8286,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 224,
          "modified_text": "906 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        },
        {
          "id": "65133a60be1d9162d87c5e93",
          "name": "Play Ransomware",
          "description": "Malicious. Various unknown, unauthorized clouds set up on a device.",
          "modified": "2023-10-26T19:03:33.397000",
          "created": "2023-09-26T20:09:04.704000",
          "tags": [
            "ssl certificate",
            "historical ssl",
            "referrer",
            "subdomains",
            "resolutions",
            "communicating",
            "contacted",
            "llwn",
            "threat roundup",
            "family",
            "roots",
            "lolkek",
            "tzw variants",
            "play ransomware",
            "ursnif",
            "malware"
          ],
          "references": [],
          "public": 1,
          "adversary": "",
          "targeted_countries": [],
          "malware_families": [
            {
              "id": "Trojan/Banker.AndroidOS.bzd",
              "display_name": "Trojan/Banker.AndroidOS.bzd",
              "target": null
            }
          ],
          "attack_ids": [
            {
              "id": "T1059.007",
              "name": "JavaScript",
              "display_name": "T1059.007 - JavaScript"
            },
            {
              "id": "T1071",
              "name": "Application Layer Protocol",
              "display_name": "T1071 - Application Layer Protocol"
            },
            {
              "id": "T1071.001",
              "name": "Web Protocols",
              "display_name": "T1071.001 - Web Protocols"
            },
            {
              "id": "T1071.004",
              "name": "DNS",
              "display_name": "T1071.004 - DNS"
            },
            {
              "id": "T1005",
              "name": "Data from Local System",
              "display_name": "T1005 - Data from Local System"
            }
          ],
          "industries": [],
          "TLP": "green",
          "cloned_from": null,
          "export_count": 22,
          "upvotes_count": 0,
          "downvotes_count": 0,
          "votes_count": 0,
          "locked": false,
          "pulse_source": "web",
          "validator_count": 0,
          "comment_count": 0,
          "follower_count": 0,
          "vote": 0,
          "author": {
            "username": "scoreblue",
            "id": "254100",
            "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
            "is_subscribed": false,
            "is_following": false
          },
          "indicator_type_counts": {
            "FileHash-SHA256": 1064,
            "FileHash-MD5": 41,
            "FileHash-SHA1": 43,
            "domain": 1023,
            "hostname": 1520,
            "URL": 4595
          },
          "indicator_count": 8286,
          "is_author": false,
          "is_subscribing": null,
          "subscriber_count": 226,
          "modified_text": "906 days ago ",
          "is_modified": true,
          "groups": [],
          "in_group": false,
          "threat_hunter_scannable": true,
          "threat_hunter_has_agents": 1,
          "related_indicator_type": "URL",
          "related_indicator_is_active": 1
        }
      ],
      "references": [
        "www.tripphouse.com",
        "http://www.tripphouse.com/th_ext.php",
        "https://attack.mitre.org/techniques/T1574/"
      ],
      "related": {
        "alienvault": {
          "adversary": [],
          "malware_families": [],
          "industries": [],
          "unique_indicators": 0
        },
        "other": {
          "adversary": [],
          "malware_families": [
            "Phishing hsbc",
            "Trojan/banker.androidos.bzd"
          ],
          "industries": [],
          "unique_indicators": 15097
        }
      }
    },
    "false_positive": [],
    "alexa": "http://www.alexa.com/siteinfo/flexradio.com",
    "whois": "http://whois.domaintools.com/flexradio.com",
    "domain": "flexradio.com",
    "hostname": "staging.flexradio.com"
  },
  "geo": {},
  "geo_ipapicom": {},
  "pulse_count": 9,
  "pulses": [
    {
      "id": "65bbca54daebb7d2084f350d",
      "name": "Phishing HSBC (identity theft) -  Hijack Execution Flow",
      "description": "Hijack Execution Flow: Adversaries may execute their own malicious payloads by hijacking the way operating systems run programs. Hijacking execution flow can be for the purposes of persistence, since this hijacked execution may reoccur over time. Adversaries may also use these mechanisms to elevate privileges or evade defenses, such as application control or other restrictions on execution.\n\nThere are many ways an adversary may hijack the flow of execution, including by manipulating how the operating system locates programs to be executed. How the operating system locates libraries to be used by a program can also be intercepted. Locations where the operating system looks for programs/resources, such as file directories and in the case of Windows the Registry, could also be poisoned to include malicious payloads.",
      "modified": "2024-03-02T16:00:27.416000",
      "created": "2024-02-01T16:44:04.317000",
      "tags": [
        "backdoor",
        "generic malware",
        "mydoom",
        "threat report",
        "ip summary",
        "url summary",
        "summary",
        "sample",
        "samples",
        "detection list",
        "blacklist http",
        "hsbc group",
        "phishtank http",
        "phishing hsbc",
        "traffic",
        "tor exit",
        "exit",
        "node tcp",
        "et tor",
        "known tor",
        "tor known",
        "http spammer",
        "node",
        "spammer",
        "malicious",
        "malware",
        "team",
        "download",
        "http response",
        "final url",
        "xamzexpires600",
        "serving ip",
        "address",
        "status code",
        "body length",
        "b body",
        "sha256",
        "headers",
        "algorithm",
        "v3 serial",
        "number",
        "subject public",
        "key info",
        "key algorithm",
        "key identifier",
        "subject key",
        "identifier",
        "x509v3 key",
        "first",
        "server",
        "registrar abuse",
        "iana id",
        "contact phone",
        "dnssec",
        "domain status",
        "registrar url",
        "registrar whois",
        "llc registry",
        "expiry date",
        "date",
        "dns replication",
        "basic",
        "pe32 executable",
        "ms windows",
        "intel",
        "win32 dynamic",
        "link library",
        "os2 executable",
        "clipper dos",
        "executable",
        "pe32",
        "win16 ne",
        "pe32 installer",
        "mitre"
      ],
      "references": [
        "http://www.tripphouse.com/th_ext.php",
        "www.tripphouse.com",
        "https://attack.mitre.org/techniques/T1574/"
      ],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Phishing HSBC",
          "display_name": "Phishing HSBC",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1574",
          "name": "Hijack Execution Flow",
          "display_name": "T1574 - Hijack Execution Flow"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 7,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "OctoSeek",
        "id": "243548",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_243548/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-MD5": 2190,
        "FileHash-SHA1": 244,
        "FileHash-SHA256": 775,
        "URL": 2229,
        "domain": 545,
        "hostname": 723,
        "CVE": 1,
        "email": 2
      },
      "indicator_count": 6709,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 219,
      "modified_text": "778 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a67da62bb520508659a5",
      "name": "Play Ransomware",
      "description": "",
      "modified": "2023-12-06T16:51:09.511000",
      "created": "2023-12-06T16:51:09.511000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1064,
        "hostname": 1520,
        "domain": 1023,
        "URL": 4595,
        "FileHash-SHA1": 43,
        "FileHash-MD5": 41
      },
      "indicator_count": 8286,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 112,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a67567202b93ee502ff7",
      "name": "Play Ransomware",
      "description": "",
      "modified": "2023-12-06T16:51:00.527000",
      "created": "2023-12-06T16:51:00.527000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1064,
        "hostname": 1520,
        "domain": 1023,
        "URL": 4595,
        "FileHash-SHA1": 43,
        "FileHash-MD5": 41
      },
      "indicator_count": 8286,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 110,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a66d9992e6957b2d1415",
      "name": "Play Ransomware",
      "description": "",
      "modified": "2023-12-06T16:50:53.855000",
      "created": "2023-12-06T16:50:53.855000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 8,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1064,
        "hostname": 1520,
        "domain": 1023,
        "URL": 4595,
        "FileHash-SHA1": 43,
        "FileHash-MD5": 41
      },
      "indicator_count": 8286,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 110,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "6570a667be1f5233855ae115",
      "name": "Play Ransomware",
      "description": "",
      "modified": "2023-12-06T16:50:47.344000",
      "created": "2023-12-06T16:50:47.344000",
      "tags": [],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [],
      "attack_ids": [],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 9,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "api",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "StreamMiningEx",
        "id": "262917",
        "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1064,
        "hostname": 1520,
        "domain": 1023,
        "URL": 4595,
        "FileHash-SHA1": 43,
        "FileHash-MD5": 41
      },
      "indicator_count": 8286,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 109,
      "modified_text": "865 days ago ",
      "is_modified": false,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65133a5300c7fbb0ebe0aad3",
      "name": "Play Ransomware",
      "description": "Malicious. Various unknown, unauthorized clouds set up on a device.",
      "modified": "2023-10-26T19:03:33.397000",
      "created": "2023-09-26T20:08:51.070000",
      "tags": [
        "ssl certificate",
        "historical ssl",
        "referrer",
        "subdomains",
        "resolutions",
        "communicating",
        "contacted",
        "llwn",
        "threat roundup",
        "family",
        "roots",
        "lolkek",
        "tzw variants",
        "play ransomware",
        "ursnif",
        "malware"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan/Banker.AndroidOS.bzd",
          "display_name": "Trojan/Banker.AndroidOS.bzd",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        }
      ],
      "industries": [],
      "TLP": "white",
      "cloned_from": null,
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1064,
        "FileHash-MD5": 41,
        "FileHash-SHA1": 43,
        "domain": 1023,
        "hostname": 1520,
        "URL": 4595
      },
      "indicator_count": 8286,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 225,
      "modified_text": "906 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65133a5622544406ab139161",
      "name": "Play Ransomware",
      "description": "Malicious. Various unknown, unauthorized clouds set up on a device.",
      "modified": "2023-10-26T19:03:33.397000",
      "created": "2023-09-26T20:08:53.825000",
      "tags": [
        "ssl certificate",
        "historical ssl",
        "referrer",
        "subdomains",
        "resolutions",
        "communicating",
        "contacted",
        "llwn",
        "threat roundup",
        "family",
        "roots",
        "lolkek",
        "tzw variants",
        "play ransomware",
        "ursnif",
        "malware"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan/Banker.AndroidOS.bzd",
          "display_name": "Trojan/Banker.AndroidOS.bzd",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 14,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1064,
        "FileHash-MD5": 41,
        "FileHash-SHA1": 43,
        "domain": 1023,
        "hostname": 1520,
        "URL": 4595
      },
      "indicator_count": 8286,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "906 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65133a5d65c4b99d76421b48",
      "name": "Play Ransomware",
      "description": "Malicious. Various unknown, unauthorized clouds set up on a device.",
      "modified": "2023-10-26T19:03:33.397000",
      "created": "2023-09-26T20:09:01.502000",
      "tags": [
        "ssl certificate",
        "historical ssl",
        "referrer",
        "subdomains",
        "resolutions",
        "communicating",
        "contacted",
        "llwn",
        "threat roundup",
        "family",
        "roots",
        "lolkek",
        "tzw variants",
        "play ransomware",
        "ursnif",
        "malware"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan/Banker.AndroidOS.bzd",
          "display_name": "Trojan/Banker.AndroidOS.bzd",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 15,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1064,
        "FileHash-MD5": 41,
        "FileHash-SHA1": 43,
        "domain": 1023,
        "hostname": 1520,
        "URL": 4595
      },
      "indicator_count": 8286,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 224,
      "modified_text": "906 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    },
    {
      "id": "65133a60be1d9162d87c5e93",
      "name": "Play Ransomware",
      "description": "Malicious. Various unknown, unauthorized clouds set up on a device.",
      "modified": "2023-10-26T19:03:33.397000",
      "created": "2023-09-26T20:09:04.704000",
      "tags": [
        "ssl certificate",
        "historical ssl",
        "referrer",
        "subdomains",
        "resolutions",
        "communicating",
        "contacted",
        "llwn",
        "threat roundup",
        "family",
        "roots",
        "lolkek",
        "tzw variants",
        "play ransomware",
        "ursnif",
        "malware"
      ],
      "references": [],
      "public": 1,
      "adversary": "",
      "targeted_countries": [],
      "malware_families": [
        {
          "id": "Trojan/Banker.AndroidOS.bzd",
          "display_name": "Trojan/Banker.AndroidOS.bzd",
          "target": null
        }
      ],
      "attack_ids": [
        {
          "id": "T1059.007",
          "name": "JavaScript",
          "display_name": "T1059.007 - JavaScript"
        },
        {
          "id": "T1071",
          "name": "Application Layer Protocol",
          "display_name": "T1071 - Application Layer Protocol"
        },
        {
          "id": "T1071.001",
          "name": "Web Protocols",
          "display_name": "T1071.001 - Web Protocols"
        },
        {
          "id": "T1071.004",
          "name": "DNS",
          "display_name": "T1071.004 - DNS"
        },
        {
          "id": "T1005",
          "name": "Data from Local System",
          "display_name": "T1005 - Data from Local System"
        }
      ],
      "industries": [],
      "TLP": "green",
      "cloned_from": null,
      "export_count": 22,
      "upvotes_count": 0,
      "downvotes_count": 0,
      "votes_count": 0,
      "locked": false,
      "pulse_source": "web",
      "validator_count": 0,
      "comment_count": 0,
      "follower_count": 0,
      "vote": 0,
      "author": {
        "username": "scoreblue",
        "id": "254100",
        "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_254100/resized/80/avatar_3b9c358f36.png",
        "is_subscribed": false,
        "is_following": false
      },
      "indicator_type_counts": {
        "FileHash-SHA256": 1064,
        "FileHash-MD5": 41,
        "FileHash-SHA1": 43,
        "domain": 1023,
        "hostname": 1520,
        "URL": 4595
      },
      "indicator_count": 8286,
      "is_author": false,
      "is_subscribing": null,
      "subscriber_count": 226,
      "modified_text": "906 days ago ",
      "is_modified": true,
      "groups": [],
      "in_group": false,
      "threat_hunter_scannable": true,
      "threat_hunter_has_agents": 1,
      "related_indicator_type": "URL",
      "related_indicator_is_active": 1
    }
  ],
  "error": null,
  "vt": {
    "error": "VirusTotal rate limit reached. Try again shortly.",
    "indicator": "https://staging.flexradio.com",
    "type": "URL"
  },
  "abuseipdb": null,
  "urlhaus": {
    "indicator": "https://staging.flexradio.com",
    "type": "URL",
    "found": false,
    "verdict": "clean",
    "error": null
  },
  "from_cache": true,
  "_cached_at": 1776629800.70227
}